Add an Android ECH suite - #4
Merged
Merged
Conversation
Encrypted Client Hello, end to end, against containers: a DoH resolver answering HTTPS records that carry an ECH config list, and an origin that reports whether the handshake it accepted used ECH. Three hostnames cover the three outcomes — accepted, rejected then retried with the origin's config, and rejected with no config on offer, which should fall back to a handshake without ECH. This came from square/okhttp, where container-based tests aren't wanted in the main test suite. That is what this repository is for. ECH is applied on Android only — JVM platforms take the config list and ignore it — so the tests are instrumentation tests on API 37, and the containers run on the host with `adb reverse` bridging the two. The fixture is therefore its own module: a process that starts the containers, publishes its ports and CA to a file, and stays up until that file is deleted. `run-ech-test.sh` drives it, and `--smoke-only` covers a machine with no emulator. The suite tests 5.5.0-SNAPSHOT rather than the pinned release: it needs `DnsOverHttps.Builder.includeServiceMetadata`, and 5.4.0 resolves A and AAAA records only, so there is no HTTPS record to carry a config list. Suites now bring their own Kotlin plugin, since an Android module can't share one with the JVM suites; the public-API check applies to all of them either way, and is wired to `connected…AndroidTest` as well as to `check`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FY1TEudFJ4vQfrfLWA5w3V
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the Encrypted Client Hello test from lysine-dev/okhttp#9652 into the testbed, which is where a container-based test belongs.
What it tests
A DoH resolver answering HTTPS records that carry an ECH config list, and an origin that reports back whether the handshake it accepted used ECH. Three hostnames, three outcomes:
green.secret.testretry.secret.testdisabled.secret.testShape
ECH is applied on Android only — JVM platforms take the config list and ignore it — so these are instrumentation tests on API 37, and there is nothing here for the
containerssuite to assert.ech-fixture— the Go program behind both containers, plus the host-side process that starts them. Not a suite: the device that runs the tests has no Docker, so the containers live on the host, and the fixture publishes its ports and the fixture CA to a file and stays up until that file is deleted.android-ech— the instrumentation tests, public API only (OkHttpClient,Request,DnsOverHttps), underokhttp.testbed.android.ech.android-ech/run-ech-test.sh— starts the fixture, bridges the ports withadb reverse, runs the tests.--smoke-onlystops after the fixture is up, for a machine with no emulator..github/workflows/android-ech.yml— its own workflow on an API 37 emulator, on the same events ascontainersplus its own daily schedule. Separate so a flaky emulator doesn't colour the container suites.Version
This suite tests
5.5.0-SNAPSHOTby default, carried as a separateech-okhttpentry in the catalog. It needsDnsOverHttps.Builder.includeServiceMetadata, and no release has it — 5.4.0 resolves A and AAAA only, so there is no HTTPS record to carry a config list.-PokhttpVersionstill overrides, andech-okhttpcan go away once a release ships the API.Build changes
AGP can't share the root's Kotlin plugin, so suites now apply their own and the root reacts to whichever they applied. The public-API check still applies to every module, and is now wired to
connected…AndroidTestas well ascheck, which doesn't cover instrumentation tests.Verification
No Docker daemon or emulator in this environment, so the suite has not been run. What was checked:
:ech-fixture:compileKotlin,:android-ech:assembleDebugAndroidTest(resolves the snapshot and compilesEncryptedClientHelloTestinto the test APK — confirmed in the dex),:containers:compileTestKotlinandcheckPublicApiOnlystill green,checkPublicApiOnlyconfirmed inconnectedDebugAndroidTest's task graph, the Go fixture built under Go 1.25, andbash -non the script. The first CI run is the real check.Generated by Claude Code